Asa general rule, I believe that if an organization is too small to have an IT department, they are too small to place credit card or other sensitive data on a computer-based system. Instead, they should either keep all credit card data in paper format and store it in locked safes, or keep no credit card data at all. Without full-time professional IT management, there is too much risk of losing credit card data. Certainly someone with Graham’s level of expertise ought not to have been allowed to store credit card data on a computerbased system.

 LO.1